'It's easier to hack an election than eBay': confessions of a Belarusian hacker | Hacker News Reader

'It's easier to hack an election than eBay': confessions of a Belarusian hacker

theguardian.com

68 pointsadamnemecek57 comments

Were voting machines hacked? No.

Was damaging information about a candidate made public? Yes.

Does the substance of that information matter at all, or simply that it was released?

"Hacked the election" is ridiculous. As if these people[0], or any other midwest-Obama-voter-turned-Trump voter needed WikiLeaks to tell them they were unhappy with the way things were going, had economic anxiety, and didn't see anyone but Trump speaking to their concerns, or simply didn't vote. What Vladimir Putin or Julian Assange wanted, never factored into their decision.

No evidence that Russia was WikiLeaks source has ever been presented, has it? We certainly DID learn from WikiLeaks that the DNC and media "fixed" the debates to favor Hillary Clinton though[1], but where's the outrage at that?

[0] https://medium.com/@Chris_arnade/trump-politics-and-option-p...

[1] http://www.nydailynews.com/news/politics/donna-brazile-final...

> Were voting machines hacked? No.

It's been more than 10 years since researchers showed that voting machines were hackable, and I have yet to see any visible progress down the path of "make voting machines less hackable / more transparent". All it would honestly take is a requirement that all voting machines print out a receipt of the vote. Then you could drop that into a box on your way out, and someone counts those votes to make sure they line up with what the database says the final vote was.

> All it would honestly take is a requirement that all voting machines print out a receipt of the vote.

I'm not sure if this would actually help, what should happen in the event that somebody claims the printed ticket disagrees with their vote? Especially considering the vote itself should remain secret in many countries.

I'm not sure how it works elsewhere (I'm in Texas), but when I voted in November, they gave me a 4-digit number to enter when I first walked up to the machine. If I told them "this receipt doesn't match the ballot I cast", I suppose they could type my 4-digit number into the computer and say "delete this ballot", feed the receipt into a shredder, and then give me a new 4-digit number to try again. They wouldn't need to see what my receipt says to do that.

But you could very easily forge a receipt to commit fraud,* so there would have to be some kind of biometric or cryptographic security.

*Possibly in conjunction with targeting precincts that heavily favor one party, or individual voters registered with a specific party.

Yes, you probably could. Local person votes twice, 5 people commit fraud type stuff is incredibly hard to prevent and probably happens every election. As long as it requires X people to move X votes fraudulently, I would say we are going to be OK. Can you move a local election in a small town via this method? Probably, but our election system has defense in depth (recounts, election judges, polling, every-knows-everyone, voting receipts, etc. etc) so this isn't exactly easy.

It becomes a problem when 1-10 people can change the outcome of a district+ size voting block. "Hacking a voting machine" falls into this category. If 1-10 people can change a Red state to Blue via any method, that is what we should be concerned about. Again, defense in depth applies here. They would have to do many things perfectly AND get lucky for this to even be a possibility (no recounts, no voting machine inspection, no election judges intuition, etc. etc. etc.)

If my crazy uncle wants to vote twice, eh go ahead. Its difficult to do, takes a medium amount of effort and might work or might not.

2 out of 10 voters use machines that don't have a paper trail like you suggest.

http://www.nbcnews.com/news/us-news/paperless-pennsylvania-c...

You get a receipt that show your vote. After veryfying the vote, You physically and manually put the receipt in the ballot box as with manual voting.

The physical receipts are the legally valid votes and can be counted with leisure in the days after the election. The electronic copy can be used for fast aggregation and to give instant results at the end of the voting day.

You'd have to guarantee that every person who votes puts their receipt in a box.

An even easier way is that you fill out a paper ballot and place it into a machine. The machine counts scans the ballot and counts it, but the ballot is still retained for handcounting if necessary.

> that voting machines were hackable,

After CIA and NSA leaks we found pretty much anything with a chip and an OS is hackable. The question is what can one do with that info.

Initially after elections I understood "election was hacked" to mean there is clear evidence of FSB or GRU intelligence officers hiding around the bushes in Wisconsin with laptops and usb keys, taking out guards and rooting voting machine. We haven't seen a single instance of that.

DNC, and Hillary's questionably illegal server were hacked. Probably by any state actor who wasn't a complete dummy. But that's pretty far from what the initial implications where.

I am still waiting for some solid "Russians hacked our election" evidence. Thought this was finally it. But there is more waiting needed it seems...

This is a bit like the WMD story and Iraq war. Still waiting to find that large WMD warehouse to justify trillions spend on that war...

"in Wisconsin"

Wisconsin has unhackable optical scantron 80s/90s voting technology.

Its unhackable because the votes are electronically counted and reported after the polls close in minutes, hours at most, then the physical paper ballots can be slowly and methodically counted and compared to the electronic counts. You could probably stick an eprom in there that reports 2e32-1 votes for Hillary or whatever, but that "hacked" result isn't going to last more than an hour, maybe a day at most.

> Initially after elections I understood "election was hacked" to mean there is clear evidence of FSB or GRU intelligence officers hiding around the bushes in Wisconsin with laptops and usb keys, taking out guards and rooting voting machine. We haven't seen a single instance of that.

You may have understood it to be that way, but it was not portrayed in that light. It was hacked in the same sense as "growth hacking" and hacking of non-voting machines.

I don't get why the US has to make it so complicated. The UK has a similar first past the post system. All votes are crosses on paper ballots, counted by hand overnight. Works fine.

This is how we do it in New Hampshire. It works fine here too.

Perhaps the problem is scale? New Hampshire is one of the smaller states, and the UK is obviously quite a bit less populous than the US.

Or perhas it's just a need for instant gratification. There's a reason New Hampshire was one of the last states to be called this year.

Shouldn't really make a difference. Just add more counters. Counting votes is perfectly parallelizable.

(1) Resources ought to scale with size.

(2) I would imagine that you'd go with the database on election night, but in days following, verify the paper votes as convenient.

I'm sure you used to count votes manually before computers existed.

Actually the biggest problem at this point is that measures to detect hacking of any kind are severely lacking.

>All it would honestly take is a requirement that all voting machines print out a receipt of the vote. Then you could drop that into a box on your way out, and someone counts those votes to make sure they line up with what the database says the final vote was.

That would work, but sounds like a very expensive way to achieve the same level of functionality as a red pencil.

>Were voting machines hacked? No.

Almost Nobody has been saying they have,(it's becoming a strawman), most of the hacking accusations have been about emails and potential collusion between those hackers and the Trump admin

That isn't what a strawman is.

s/strawman/red herring/

The point is, the narrative is not even addressing that sort of issue because there is no evidence that any machines were successfully hacked.

Yet the phrase "hacked the election" is thrown about intentionally to muddy the issue. To fool the low information voter who may conclude that Russia, in cahoots with Donald Trump, changed vote tallies.

This is much stronger propaganda than explaining what actually happened:

Wikileaks exposed a few (not all that many, but some) shady actions on the part of the DNC, the media, as well as shining some light on HRC's true views on issues (having a "private" and "public" position, corporate speeches, Clinton Foundation donations, etc.) All in all, not that big of a deal.

To the degree it is, how is it anyone's fault but HRC and her campaign? Why is dirty laundry the fault of her political opponent? Why is leaking information that maybe damaging to a candidate described as "hacking the election"?

Can you provide me with any evidence of collusion between anyone from Russia and Trump?

I think the main thing is the hacking was done to effect the election and it was at least moderately successful in that goal. Regardless of everything else that alone seems worrying to me

I think the effect that the leaks had on the election is very overstated. It seems much more plausible to me that Hillary was a bad candidate who ran a poor campaign. She played up her "experience" even while Trump received his party's nomination for not being a Washington insider. She has the charisma of a moldy onion. She had her husband meet with the Attorney General at an airport while she was being investigated by the FBI, who subsequently decided not to prosecute her. She half heartedly campaigned in several important states that ultimately decided the election. I could go on, but the point is that Hillary "hacked" her own election.

No, the OP is correct about it. The narrative being presented is muddying the issue. They're not out there to convince you, me, or most of HN, who I'm assuming are literate or informed individuals. They're out there trying to convince the low-information voter, cast doubt, and generally give them enough mental-ammo to convince themselves that their preferred vote is the "right" one objectively.

Of all the ways to influence an election, revealing true facts seems to be by far the best for the Democratic process.

Of course it would be better if hacking wasn't part of that. And you can argue that foreign influence in the election is a bad thing. But the American people really have no standing to complain about that, not with all the well known instances where the US meddling in other countries elections.

I agree that facts are good the problem is when facts are revealed very asymmetrically. Let's pretend you have two candidates, one where you really only know about him from his voting record and public statements and the other where you know everything that they and their associates have ever done. My guess is that the fist candidate will be more likely to win. I think that if that asymmetry is too prevalent it gives an unfair advantage to one side and in my view that weakens the democracy.

> Wikileaks exposed a few (not all that many, but some) shady actions on the part of the DNC, the media, as well as shining some light on HRC's true views on issues (having a "private" and "public" position, corporate speeches, Clinton Foundation donations, etc.) All in all, not that big of a deal.

Really? Because I know for a fact that tons of people jumped on those leaks to say that Hillary was untrustworthy. They absolutely exacerbated the rift between Bernie and Hillary supporters. This is how swaying elections works, by pushing a specific narrative. When that "dirty laundry" (nothing illegal) is illegally dug up by a rival nation state, you think nothing is wrong? There's nothing to look into here?

No, we don't have definite evidence of collusion yet, but why don't you ask the FBI which is actively investigating Trump? This isn't Pizzagate. This is happening: the intelligence community already knows that Russia was behind the WikiLeaks hacks, and now they have found Trump suspicious enough to be worthy of investigation. You can't handwave that away.

> Almost Nobody has been saying they have

It is there by implication. "Russians hacked out elections". Articles and people on social media somehow always forget to insert the caveat there that there is no clear evidence vote hacking.

Notice how many people donated towards the recount in Wisconsin. That was done in large because of the implication of "hacking" as in "the vote count was hacked". And in the end Trump ended with 3 more votes and Stein with a few million in her party's pocket.

So we can say it is a strawman but I think the strawman is a strawman as well as many people believe that narrative.

> We certainly DID learn from WikiLeaks that the DNC and media "fixed" the debates to favor Hillary Clinton though[1], but where's the outrage at that?

Don't be silly. Why should the people in power punish themselves just because they happened to get caught? They always externalize blame, no matter how irrational.

Look what happened with Snowden: it's the leaker who is the problem, not the leaked material. How many people have been fired over that incident? And how many people have been assigned to hunt him down? I bet you the latter number is higher.

The DNC has no such issues though. The leaker was identified and according to various internet sources later found murdered[1]. Guess if anyone is currently investigating that...

[1] http://www.zerohedge.com/news/2016-08-10/wikileaks-assange-h...

Isn't zerohedge a known Russian and Chinese propaganda outlet?

I have no idea. It's mentioned lots of places though. I just chose one more or less at random:

https://duckduckgo.com/?q=dnc+leaker+murdered&t=ffip&ia=web

Irrespective of the accuracy of that report, the rest of my comment still holds though. People in power aren't going to punish themselves.

Why post anything from ZeroHedge? Really....

edit: the author is Tyler Durden ;)

The wikileaks stuff did have some effect, but not as much as Comey's last minute lie about finding a laptop full of Hillary emails.

Russian hacking was more influential in the congressional elections where "Guccifer 2.0" worked directly with Republican congressional campaigns providing them internal DCCC info.

> "...but not as much as Comey's last minute lie about finding a laptop full of Hillary emails."

Comey did find emails on a laptop confiscating during an investigation of Anthony Weiner because Weiner was texting/sexting a 15-year-old. Weiner was the husband of a chief Hilary Lieutenant and there were email exchanges between her and Clinton. There were missing emails because Clinton had destroyed 30,000 emails that the FBI had asked her to turn over to them.

When Secretary of State, instead of using the official government email server which was necessary not only for security/hacking reasons but because by law a record of correspondence needed to be stored on government servers for future Freedom of Information Act (FOIA) requests, used a private email server in her home.

She did this precisely so that her emails could be hidden from FOIA.

When requested by the FBI to turn over her emails, Clinton had 30,000 of them destroyed.

The Democrats never, never should have had as a candidate someone who would feel they were above the law and set up her own home email server. To me, it is simply baffling that they would ever nominate such a person and shows a profound lack of judgment on the part of DNC leadership and the Democratic elites.

Nothing Trump or the Russians or whomever has ever done comes close to the seriousness of using a home email server for Secretary of State emails. Of all people, HN readers should understand that.

I am a midwest Obama voter who voted for Trump. I don't like anything about him in all honestly. I voted quite literally because of Assange. I followed each leak that was dropped religiously and had a lot of fun bonding with others who searched through them on various reddit boards uncovering information.

All this is to say that generalizations like the one you made are almost never correct, and never tell the whole story. I voted for Bernie in the primary.

Acting like the subcategory I'm in doesn't exist and only furthers misunderstanding of the various complex social systems that were at play in this election creating the outcome.

This is how I see it: Post-primaries, I think Hillary was a much better candidate. However a large number of liberals chose to campaign for her by just straight up calling the other side racists, while ignoring her flaws / blaming them on Russians. (We are all flawed, just accept it and don't blame it on others, otherwise you might just come across as narcissistic). In the case this was done in a false-flag fashion, then the democrats didn't catch it / didn't do the obvious thing to combat it. I mean come on guys.

It is likely true that there 'are' lots of racist / deplorable voters however it is analogous to this: If I were fat, I would probably not like people yelling "hey fattie! / run forrest run" at me while I am out jogging trying to improve myself. In the end, although I did not vote for Trump, (and am not fat), it did kind of seem to me that Democrats / liberals during this election, came across (regardless of whether they actually are, which I strongly doubt) as the gang from globo-gym, and I can just picture an image of a White Goodman (Ben Stiller's character) calling the other side 'deplorable.'

(To Hillary's credit she seemed very apologetic during the second of the three debates)

Add to this exchanges like the one between Podesta / Assange [1] which just served to reinforce this image, and you have a recipe for the election upset which happened.

I am sure at the end of the day there will be some voters you cannot reach, but I imagine, if you just use basic human empathy, it will reach a whole lot of people.

The moral of this story, for either side, should be:

1. Don't treat the other side poorly / call them names. Instead, use reasoning about policies, compassion, and acceptance of your own flaws to win voters.

2. Be wary of possible false-flag tactics- no one has brought up evidence that this happened, but I wouldn't be at all surprised.

3. Don't rely solely on things like this: https://www.washingtonpost.com/news/post-politics/wp/2016/11...

humans are not machines to feed variables and get out votes- use actual compassion / empathy/ and talk to people. Or maybe, smarter, don't rely solely on your super algorithm sauce - obviously data analysis will help, but it shouldn't be the whole picture.

[1] http://thehill.com/policy/cybersecurity/301069-podesta-fires...

Apparently cannot edit comments after they are made anymore within two hours (it used to be three I believe), but I was going to add a point to the analogy in the second paragraph, since I know things are easily taken incorrectly: I am not trying to make equivalent fat <-> racist (there is nothing wrong with being fat, and yes there are things wrong with being racist), the equivalence I am trying to point out is that if we attack / look down on people, for whatever reason, we are not being helpful.

Russia can only do what they can do, that's not the scandal. If you have members of the Trump campaign openly working together with them, they need to go to jail.

>We certainly DID learn from WikiLeaks that the DNC and media "fixed" the debates to favor Hillary Clinton though[1], but where's the outrage at that?

Um... everywhere among bernie supporters? If you haven't seen outrage about the dem primary debates from the left you haven't been looking. More importantly though, this seems to be a total deflection mechanism. Why deflect to that issue when we've got a much bigger one right here?

The election was hacked because implying there was no outside force would imply there was an internal problem. An internal problem such as an unelectable candidate being selected by a faulty biased selection process. Or the legacy regional alliances being shattered. Perhaps long cherished beliefs and ideals and slogans are simply obsolete, dead in the voting marketplace. Or the impact of demographic trends. Or simple utter gross incompetence of individual party leadership. Extremely painful questions need to be asked if the loss was not due to Russian Hacking.

Therefore the powers that be, declare the only problem with the election at any level was Russian Hacking. Its a thought crime directly attacking the existing party leadership to consider is could be anything else. Would you go up against the DNC? They own TV and radio and newspapers and many websites, you'd be a fool to do anything but nod your head in agreement and repeat after them that the DNC did nothing wrong and the only problem was Russian Hacking.

You're not going to see the R party disagreeing, other than trolling and LOLz, because a profoundly dysfunctional D party directly benefits them next time. Imagine the R party perspective, sure guys, do the same thing that didn't work plus more WW3 warmongering against Russia, how could the R party not win against that again?

Don't hurt anyone's feelings, whatever you do, blame the Russian Hackers.

The "election" was unambiguously hacked, you can argue that the democrats are blaming it more than is reasonable, but it happened.

Basically the only thing getting a budget increase this year looks to be the military. War isn't started over stern reprimands, increasing military spending and increasing our ties to Russia seem to be the more likely sign of an upcoming war.

This is only marginally related, but I have a story about how I "hacked" Ebay way back in 200x.

At the time they provided a free VIN report whenever you listed a vehicle for sale. VIN reports provide details of the history of your car (liens, accidents, maintenance, title transfers, etc). And the leading VIN services charge about $10 per report.

I wrote a PHP script that, when given a VIN number, would create a listing on Ebay for a car with that VIN number. The script then kicked off a website scraper which would monitor the listing page for the VIN report data to be populated (sometimes took a few seconds). Once the data was captured, the script would unlist the item (so I wouldn't be stuck selling a car that didnt exist). Bam! Free VIN reports.

So I took it a step further and registered and designed a website for it. It looked very semi-professional and web 2.0-ish as I have some decent design skills. There were sample reports and calls-to-action and everything.

A user would provide a VIN, pay with paypal checkout, and get the VIN report emailed to them within minutes. The report was stripped of all data pointing to the original source, and reformatted & rebranded with my site's name. All automated of course, since I had already wrote the scripts to do the heavy lifting.

I then set up an Adwords campaign, researched price points and settled on $7.99 per report. My ad campaign used targeted keywords that displayed my ads whenever people searched for "carfax" and "vin report", with my price displayed prominently in the ad block. The more money I allotted for ads, the more money the hack made.

For about 3 weeks I just sat back and watched the money roll in. In the interest of not drawing too much attention, I would disable the entire site and ad campaign during the day, only running it at night. I was thinking 'slow and steady wins the race.' But the whole time I was working on it, I felt a rush: part paranoia about getting caught, part excitement at crafting such a sneaky, sophisticated hack with so many moving parts.

In the end, ebay noticed an anomaly in their api usage data caused by me creating and deleting so many car listings, and sent me a nastygram.

I decided to shut up shop before they realized what I was really up to. Greed will get you 'got' quicker than not.

In the end, I learned a lot -- it was my first experience working with ad campaigns, writing parses/scrapers, and working with ebays api.

Pretty clever hack/scheme. I'd classify it as a parasitic model. I'm sure there's tons more of those left including in eBay despite their increased efforts in stopping malicious posts.

This is awesome. Can you say how long it ran for, and about how much $ you made?

Neat hacks like this are why I visit this website.

thank you for sharing this

The Netherlands returned to voting with paper and pencil since a university proved that the voting machines could be hacked. It takes a day or two more to count the votes, but who cares, apart from the media? If a technology creates more problems than it solves, it should be abandoned.

This. There's no reason to use voting machines. None. Paper ballots work and can't be hacked.

> There's no reason to use voting machines. None. Paper ballots work and can't be hacked.

Many voting machines produce paper ballots, and voting machines may be more accessible to those with certain disabilities.

I think what you mean is that there is no reason to transmits votes from the voting machines to tabulators on electronic media rather than paper ballots.

> While Pavlovich says he won’t comment directly on the US election hacking allegations

Right. Finally the evidence we've been waiting for. Or, ... not.

Are we grabbing at the straws here with the "Russian" narrative. By now I think we are.

They don't say it but that's why the article was probably written. The more they write articles like these without clear evidence, the more they discredit the whole PR story and lessen its value.

It annoys me that the headlines keep claiming the election was hacked. The election was fine. The DNC was mined and information found was released. This MAY have been in an effort to sway opinion in an election, which, at best, would be scatter-shot social engineering. But the election was not hacked. At least, not that I've seen reports of.

I think they are using it in the social hacking sense.

Social hacking describes the act of attempting to manipulate outcomes of social behaviour through orchestrated actions. The general function of social hacking is to gain access to restricted information or to a physical space without proper permission.

What's the purpose of this article?

As far as 'hacking', it states that this person has purchased credit card numbers online and then used them. This can be done by anyone, you only need to know basic things such as how to use a credit card and where to purchase the numbers.

Then somehow this is turned into a headline about the US election, when there is not a single line of actual content pertaining to it. Even if there was, to go from that to 'the election was hacked'...

You guys are better than this, come on.

This is why we need risk-limiting audits. Check out recent work on end-to-end cryptographically verifiable voting systems: https://www.usenix.org/conference/evtwote13/workshop-program...

(On a side note, hand counting the entire thing is infeasible for US elections due to all the other races/proposals on the ballots).

Let's have a contest where different AIs compete to get the best election results. Hmmm... that sounds like a plot to a movie.

That's because people believe anything they read. If it's on the internet it must be true.

Reply on news.ycombinator.com